What’s Vulnerable › Vulnerabilities

CVE-2019-16239

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-17 · updated 2026-06-17
• Weakness: CWE-120

Description

process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.

Affected products

• Canonical Ubuntu Linux: 18.04
• Debian Linux: 8.0, 9.0, 10.0
• Fedoraproject Fedora: 29, 30, 31
• Infradead Openconnect: before 8.05 — fixed in 8.05
• openSUSE Leap: 15.0, 15.1

How to fix

Upgrade to a fixed version: Infradead Openconnect 8.05. Check the vendor advisory for mitigations.

References

• http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00061.html
• https://lists.debian.org/debian-lts-announce/2019/10/msg00003.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ/
• https://seclists.org/bugtraq/2020/Jan/31
• https://t2.fi/schedule/2019/
• https://usn.ubuntu.com/4565-1/
• https://www.debian.org/security/2020/dsa-4607
• http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html

Get alerted when CVE-2019-16239 or the next vulnerability affects your stack